Privacy Policy

1. Who we are

Eastbound Escapes is a trading name of Times Travel ("we", "us", "our"), a company registered in England and Wales under company number [COMPANY NUMBER], with its registered office at [COMPANY ADDRESS]. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller of the personal data described in this policy. Our ICO registration number is [ICO REGISTRATION NUMBER].

2. What this policy covers

This policy explains how we collect, use, store and share your personal data when you use our website, contact us, or enquire about and book our services. It applies to visitors to our site, enquirers, and customers. Please read it together with our Terms & Conditions and any other notice we provide when we collect your data.

3. The personal data we collect

We collect information you give us directly, such as when you complete an enquiry form, subscribe to our newsletter, or speak to us by phone or email. This may include:

• Your name, email address and telephone number.
• Details of your enquiry, including destination, travel dates, number of adults and children, budget and the package or journey you are interested in.
• Passport and traveller details where required to complete a booking (for example, names exactly as they appear on passports, dates of birth and nationality).
• Payment information (collected and processed securely by our payment provider — we do not store full card numbers).
• Any message or special requirements you choose to share with us (including health or accessibility needs you volunteer to help us support you).

We also collect limited technical data automatically when you browse the site, including your IP address, browser type, device type, approximate location, and the pages you visit.

4. Cookies and tracking

This website uses a small number of cookies, which are small text files placed on your device. We use:

• Strictly necessary cookies — required for the site to function (for example, remembering your preferences within a session). These cannot be switched off.
• Analytics cookies — used only if you consent, to help us understand how the site is used and improve it. These do not identify you directly.

We do not use advertising trackers, and we do not sell or share your browsing data with advertisers. You can control or delete cookies through your browser settings at any time. For more detail, see our cookie notice (available on request).

5. How we use your personal data

We use your personal data to:

• Respond to your enquiries and provide quotes.
• Process, confirm and manage your booking, including passing traveller details to suppliers.
• Provide customer support before, during and after travel.
• Send you marketing communications where you have consented.
• Improve and secure our website and services.
• Meet our legal, accounting and regulatory obligations.

6. Our lawful bases

Under UK GDPR we only process your personal data where we have a lawful basis to do so. We rely on the following: performance of a contract or steps taken at your request before entering into a contract (for example, to quote and fulfil your booking); compliance with legal obligations (such as accounting and immigration requirements); our legitimate interests (such as improving our services and preventing fraud), where these do not override your rights; and, for marketing, your consent, which you may withdraw at any time.

7. Sharing with third-party suppliers

To fulfil your booking we share your personal data, where necessary, with:

• Airlines, hotels, transfer providers, tour operators and other travel suppliers.
• Payment, fraud-prevention and IT service providers.
• Professional advisers, insurers and authorities where required by law.

We only share the minimum data necessary, and we never sell your personal data. Some of these suppliers are based outside the UK; where we transfer personal data internationally, we use appropriate safeguards such as standard contractual clauses to keep it protected.

8. How long we keep your data

We keep personal data only for as long as necessary for the purposes described above and to meet legal, tax and accounting requirements. Retention periods vary by type of data; once they expire, the data is securely deleted or anonymised.

9. Marketing communications

We will only send you marketing by email or message where you have opted in, and you can unsubscribe at any time using the link in any email or by contacting us. We will never pass your details to third parties for their own marketing.

10. Your rights under UK GDPR

You have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. You also have the right to withdraw consent at any time and to complain to the Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data. To exercise any of these rights, contact us at [CONTACT EMAIL].

11. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, and we require the same of our suppliers.

12. Children's data

Our services are not directed at children, and we do not knowingly collect personal data from children under 16 without parental consent. If you believe a child has provided us data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated "last updated" date.

14. Contact us

Questions about this policy or your data? Contact us at [CONTACT EMAIL] or [CONTACT PHONE], or write to [COMPANY ADDRESS].